What is a security control baseline and why is it important in Annex B?

• A. A documented set of minimum security controls for systems; ensures consistent protection and compliance.
• B. A speculative list of optional controls.
• C. A method to set up physical security only.
• D. A baseline that only applies to developers.

Answer: (A)

A security control baseline is a documented set of minimum security controls that must be in place for information systems. It creates a common starting point for protection, so systems are built and evaluated against the same standards, which helps ensure consistent protection and easier compliance with requirements.

In Annex B, this baseline matters because it provides the concrete reference for what must be implemented, guiding the selection, assessment, and authorization of systems. It allows risk to be measured consistently across systems and simplifies audits, reporting, and ongoing management as threats evolve by giving a stable floor that can be updated as needed.

It’s not a speculative or optional list, not limited to physical security, and not restricted to developers; it applies broadly to all systems and stakeholders within the organization.